quoxcli 0.4.0 → 0.6.0

package/CHANGELOG.md

@@ -0,0 +1,110 @@
+# Changelog
+
+User-visible changes to the `quoxcli` package. Items marked *(unproven)* ship in
+the package and pass their tests, but nobody has run them end to end from the
+published package yet.
+
+## 0.6.0 (2026-11-10)
+
+Nothing below has been run end to end from the published 0.6.0 package yet: treat every
+item as *(unproven from the package)*. Items marked *(driven live)* were driven against a
+live instance from the source tree before release.
+
+### New commands
+- `quox notes seal convert <id>` and `quox notes seal purge <id>` (human sessions only):
+  seal an existing plaintext note in place, then wipe its old plaintext revisions. Convert
+  names any attachments and says they are NOT protected. *(driven live)*
+- Sealed notes harden: each sealed note is bound to its note id (another note's envelope
+  is refused), the version comes from the authenticated envelope, and a local rollback
+  floor fails closed under a lock.
+- `quox notes seal` finds ENQRYPT without setup: `QUOX_ENQRYPT_PATH`, then
+  `~/.quox/enqrypt-src` (a clone of quoxai/enqrypt main plus `npm ci`); a copy missing a
+  function the CLI calls is refused by name. ENQRYPT is not on npm, and the npm package
+  named `enqrypt` is unrelated malware. *(driven live)*
+- `quox mail block | unblock | blocked | junk | trust`.
+- `quox mcp token create | list | revoke`.
+- `quox lucid goals`, `quox lucid insights`, `quox lucid brief`.
+- `quox plan brief`, `quox plan watch`, `quox plan followups` / `followup add | done | status`,
+  `quox plan roadmap archive | unarchive`, `quox plan roadmaps --archived`.
+- `quox monitoring incidents claim <id>` and `quox monitoring incidents status <id> <status>`: claim and move a
+  governance incident (witnessed, org scoped). `quox wazuh connect --indexer-ca` and
+  `--password-stdin` / `--indexer-password-stdin`.
+
+### Changes
+- `quox plan add` honours `roadmap_id` in the JSON (streams used to land in the first
+  roadmap). `quox plan focus` counts substreams and caps its output; unblockers name the
+  whole chain.
+- `quox wazuh vulns` totals are exact or labelled a lower bound (10,000+); `quox wazuh status`
+  says its agent count includes the manager; no MAINT? column when the org has no Uptime Kuma.
+- `quox offload` lists every worker lease and warns 12h before one expires; `offload release
+  --worker` targets that worker, never the shared default.
+- `quox tool exec --select .` returns the whole result. `quox actions list` fits the terminal.
+- Conversation app (`quox` with no arguments): `/wake`, `/poke` and `/page` take several
+  slots; `/inbox show N` reads a whole item; `/morningreport` digests what happened since you
+  were last here; a typed `/org switch` or `/org back` no longer asks a second y/n; an inline
+  approval says approved only after the server records it and no longer re-opens as a popup;
+  decision cards never echo the asker's pick as their own advice; contact-consent approvals ask
+  for the lawful basis; slot messages from other sessions never show raw colour codes.
+
+## 0.5.0 (2026-11-06)
+
+### New commands
+- `quox wazuh`: first-class Wazuh commands. `agents`, `fim`, `sca`, `rootcheck`
+  and `coverage` are reads. `vulns --priority` ranks CVEs by CISA KEV, EPSS,
+  CVSS and how many hosts each one hits (driven live across the fleet before
+  this release). Fleet-wide reads cover up to 200 active agents (it was a
+  silent 25 before).
+- `quox wazuh report generate | list | show | verify`: signed vulnerability
+  reports. `verify` works offline against a pinned PEM or a raw key.
+  *(unproven from the package)*
+- `quox wazuh connect`, `quox wazuh hooks create | list | rotate | delete | install`,
+  `quox wazuh incidents [--open] [--since] | show | close | diagnose | escalate`
+  and `quox wazuh triage`. Writes go through one approval per call.
+  *(unproven from the package)*
+- `quox compliance reports list | show` (read): framework, period, score,
+  status per control and sampled evidence ids. `quox compliance jobs list`, and
+  jobs can now be named. *(unproven from the package)*
+- `quox tool installed` and `quox tool uninstall`, to read back and undo a
+  `quox tool install`. *(unproven from the package)*
+- `quox approvals approve | deny | list` by id or short tail, `quox approvals withdraw`
+  (the requester takes its own hold back), and `quox approvals call-me [status|on|off]`
+  (needs the quox-voice licence).
+- `quox connect <url>` with certificate pinning per profile (`--trust-cert`,
+  `--fingerprint`), and `quox server install` (with `--dry-run`, `--yes`, `--json`).
+- `quox notes seal init | status | new | open | edit | print`: ENQRYPT sealed
+  notes. Encryption happens on your machine and the server stores only the
+  envelope. *(unproven from the package)*
+- `quox notes seal convert <id> --yes [--keep-title]` seals an existing note and
+  purges its earlier plaintext from the server (revisions, embeddings, derived
+  beliefs; human sessions only); `quox notes seal purge <id> --yes` reruns the
+  purge. Both say that backups taken earlier still hold the old text until they
+  expire. `seal edit` now takes the version from the sealed envelope, not from a
+  server field, and the local rollback floor refuses a damaged or missing floor
+  file instead of starting again from zero. *(unproven from the package)*
+- `quox admin users verify-email <email> --reason` (step-up PIN).
+- `quox memory sync`: Claude file memory is saved to Quox memory too
+  (idempotent; credential-shaped text is refused).
+- `quox inbox unread <id...>`, `quox x whoami | accounts`, `quox linkedin whoami`,
+  `quox workflow create | apply | import-n8n --activate` (a plain create is not armed).
+
+### Terminal UI (quoxon)
+- New approvals and questions open by themselves as the walkthrough card.
+- Approve verbs ask for the step-up PIN on a terminal; destructive approvals
+  need the target name typed.
+- Do not disturb and `/sleep` survive restarts; `/morningreport` gives a grouped
+  digest of what arrived while you were away.
+- `/mail` reads triaged email (read-only), `/outbox` queues `/say` sends that
+  failed on connectivity and sends them in order once you are back online.
+- Other-org approvals show on the bar, with a hint about how many more are waiting.
+- A secret paste guard asks before it sends text that looks like a credential,
+  and redacts it from history.
+- Extensions hot-reload, and extension host contract v1 is out (panels, tabs,
+  settings).
+
+### Fixes
+- An explicit `-p <profile>` with no session now fails, instead of quietly
+  using the service key.
+- `quox workflow update` finds engine workflows. `quox run list` fills in its
+  columns again.
+- Watch and loop streams back off and give up cleanly, instead of polling forever.
+- Docs links point at quox.ai/cli.

package/README.md

@@ -12,7 +12,7 @@ npm install -g quoxcli
 
 Needs Node.js 20 or later. This installs two commands: `quox`, and `quoxon` (an alias that opens the conversation).
 
-Docs: https://cli.quox.ai/docs/start/
+Docs: https://quox.ai/cli/docs/quickstart/
 
 ## Prerequisite: a running QuoxCORE
 
@@ -142,4 +142,4 @@ export NODE_EXTRA_CA_CERTS=/path/to/your-ca.pem
 Quox Community Source Licence 1.0. This is source-available software, not open source. You may self-host and inspect it freely; redistribution and repackaging are restricted. Read the full text in the `LICENSE` file or at https://github.com/quoxai/quoxcore.
 
 Website: https://quox.ai  
-CLI home: https://cli.quox.ai
+CLI home: https://quox.ai/cli

package/bin/quox.js

@@ -11,6 +11,14 @@ if (!process.env.QUOX_SESSION_ID && process.env.QUOX_SESSION_ID_FILE) {
   try { process.env.QUOX_SESSION_ID = (await import('node:fs')).readFileSync(process.env.QUOX_SESSION_ID_FILE, 'utf8').trim(); } catch { /* turn ended: no session */ }
 }
 
+// ONBOARD-P1: a profile that trusts its server's own certificate (quox connect) makes this run trust it too, via a
+// one-time re-run with NODE_EXTRA_CA_CERTS set for this process tree only. Before anything else loads.
+{
+  const { reexecWithProfileTrust } = await import('../lib/core/profileTrust.js');
+  const code = reexecWithProfileTrust(process.argv.slice(2), process.env);
+  if (code !== null) process.exit(code);
+}
+
 // CORTEX-BENCH: Node's fetch parses HTTP with a WebAssembly module, and V8
 // recompiles it at the optimising tier on a background thread; Node waits for
 // that compile before exiting, adding 350-700ms to every short command after
@@ -167,7 +175,17 @@ if (process.argv.includes('--no-color') || process.env.NO_COLOR) {
 const config = loadConfig(resolveProfileFlagFromArgv(process.argv.slice(2)));
 const auth = createAuth(config);
 const client = createClient(config, auth);
-const ctx = { config, auth, client, program };
+// A client on the SAME user's token for another org the user belongs to (minted per org, window scope, never moves the
+// profile's org). Lazy: nothing is minted unless a verb asks (approvals --org, the "more waiting in <org>" hint).
+let _orgClients = null;
+const clientForOrg = async (orgId) => {
+  if (!_orgClients) {
+    const { createWindowClient } = await import('../lib/quoxon/windowOrg.js');
+    _orgClients = createWindowClient({ config, auth, createClient }).clientForOrg;
+  }
+  return _orgClients(orgId);
+};
+const ctx = { config, auth, client, program, clientForOrg };
 
 // Register all command groups
 // Command groups, in registration order. CORTEX-BENCH (quox#7xx CLI startup):

package/bin/quoxon.js

@@ -1,6 +1,11 @@
 #!/usr/bin/env node
 import '../lib/core/prodEnv.js'; // first: production React unless NODE_ENV is set (before anything loads React)
-import { main } from '../lib/quoxon/main.js';
+{
+  const { reexecWithProfileTrust } = await import('../lib/core/profileTrust.js');
+  const code = reexecWithProfileTrust(process.argv.slice(2), process.env);
+  if (code !== null) process.exit(code);
+}
+const { main } = await import('../lib/quoxon/main.js');
 
 main().catch((err) => {
   console.error(err?.message || err);

package/lib/api/endpoints/admin.js

@@ -17,6 +17,13 @@ export const admin = {
     path: () => '/api/admin/agent-identities',
     tags: ['admin-write'],
   },
+  // ADMIN-VERIFY-EMAIL: instance-admin + human + step-up (scope override). Served by services/auth/routes/admin.js.
+  'admin.users.verify_email': {
+    method: 'POST',
+    service: 'auth',
+    path: () => '/api/admin/users/verify-email',
+    tags: ['admin-write'],
+  },
   // Instance basics after setup (app URL etc). Served by services/auth/routes/admin-instance.js.
   'admin.instance.basics.get': {
     method: 'GET',

package/lib/api/endpoints/agent-attach.js

@@ -27,6 +27,13 @@ export const agentAttach = {
     path: ({ leaseId }) => `/api/agent-attach/lease/${encodeURIComponent(leaseId)}/release`,
     tags: ['live-write'],
   },
+  // Org-wide list of live attaches (org owner/admin). Feeds `quox agent attaches` and the quoxon /roster.
+  'agent-attach.list': {
+    method: 'GET',
+    service: 'auth',
+    path: () => '/api/agent-attach',
+    tags: ['live-safe'],
+  },
   'agent-attach.status': {
     method: 'GET',
     service: 'auth',

package/lib/api/endpoints/compliance.js

@@ -0,0 +1,25 @@
+/**
+ * 'compliance.*' endpoints: scheduled compliance report jobs and generated reports.
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ */
+
+export const compliance = {
+  'compliance.jobs.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/compliance/jobs`,
+    tags: ['live-safe'],
+  },
+  'compliance.reports.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/compliance/reports`,
+    tags: ['live-safe'],
+  },
+  'compliance.reports.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id }) => `/compliance/reports/${encodeURIComponent(id)}`,
+    tags: ['live-safe'],
+  },
+};

package/lib/api/endpoints/governance.js

@@ -22,6 +22,13 @@ export const governance = {
     path: () => `/governance/incidents`,
     tags: ['live-safe'],
   },
+  // WAZ P11 slice 1b: the witnessed lifecycle move (claim = self, status with a resolution for terminal states).
+  // Collector: lib/governanceIncidentLifecycle.js. Writes, so not live-safe.
+  'governance.incidents.transition': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ id }) => `/governance/incidents/${encodeURIComponent(id)}/transition`,
+  },
   'governance.policy.compile': {
     method: 'POST',
     service: 'collector',

package/lib/api/endpoints/inbox.js

@@ -30,6 +30,12 @@ export const inbox = {
     path: ({ orgId, itemId }) => `/api/orgs/${orgId}/inbox/${itemId}/respond`,
     tags: ['live-write'],
   },
+  'inbox.withdraw': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId, itemId }) => `/api/orgs/${orgId}/inbox/${itemId}/withdraw`,
+    tags: ['live-write'],
+  },
   // quox ask: a session files a decision request (one inbox item) and waits for the human's answer.
   'inbox.decision.create': {
     method: 'POST',

package/lib/api/endpoints/inboxq.js

@@ -26,6 +26,19 @@ export const inboxq = {
     path: ({ accountId }) => `/api/v1/inboxq/accounts/${accountId}`,
     tags: ['live-write'],
   },
+  // quox#1504: per-account TLS certificate pin (human org admin only).
+  'inboxq.accounts.tlsPin': {
+    method: 'PUT',
+    service: 'collector',
+    path: ({ accountId }) => `/api/v1/inboxq/accounts/${encodeURIComponent(accountId)}/tls-pin`,
+    tags: ['live-write'],
+  },
+  'inboxq.syncStatus': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/inboxq/sync-status`,
+    tags: ['live-safe'],
+  },
   'inboxq.messages.get': {
     method: 'GET',
     service: 'collector',
@@ -99,6 +112,12 @@ export const inboxq = {
     path: ({ watchId }) => `/api/v1/inboxq/watches/${watchId}/active`,
     tags: ['live-write'],
   },
+  'inboxq.watches.delete': {
+    method: 'DELETE',
+    service: 'collector',
+    path: ({ watchId }) => `/api/v1/inboxq/watches/${watchId}`,
+    tags: ['live-write'],
+  },
   'inboxq.proposals.list': {
     method: 'GET',
     service: 'collector',
@@ -117,4 +136,43 @@ export const inboxq = {
     path: ({ proposalId }) => `/api/v1/inboxq/proposals/${proposalId}/resolve`,
     tags: ['live-write'],
   },
+  // EMAIL-Q CLI audit (2026-11-09): the sender/junk routes the dashboard already
+  // calls (src/components/inboxq/lib/api.js), wrapped by `quox mail block|unblock|
+  // blocked|junk|trust`. No new server logic: these are the existing InboxQ routes.
+  'inboxq.messages.search': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/inboxq/messages/search`,
+    tags: ['live-safe'],
+  },
+  'inboxq.messages.confirmJunk': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/inboxq/messages/confirm-junk`,
+    tags: ['live-write'],
+  },
+  'inboxq.senders.block': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/inboxq/senders/block`,
+    tags: ['live-write'],
+  },
+  'inboxq.senders.unblock': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/inboxq/senders/unblock`,
+    tags: ['live-write'],
+  },
+  'inboxq.senders.blocked': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/inboxq/senders/blocked`,
+    tags: ['live-safe'],
+  },
+  'inboxq.senders.trust': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/inboxq/senders/trust`,
+    tags: ['live-write'],
+  },
 };

package/lib/api/endpoints/index.js

@@ -74,6 +74,7 @@ import { budgets } from './budgets.js';
 import { calendarq } from './calendarq.js';
 import { catalog } from './catalog.js';
 import { chat } from './chat.js';
+import { compliance } from './compliance.js';
 import { consent } from './consent.js';
 import { conversations } from './conversations.js';
 import { customRoles } from './custom-roles.js';
@@ -95,6 +96,7 @@ import { contactsq } from './contactsq.js';
 import { x } from './x.js';
 import { llmPolicy } from './llm-policy.js';
 import { hat } from './hat.js';
+import { mcp } from './mcp.js';
 import { members } from './members.js';
 import { memory } from './memory.js';
 import { mfa } from './mfa.js';
@@ -166,6 +168,7 @@ export const ENDPOINTS = {
   ...calendarq,
   ...catalog,
   ...chat,
+  ...compliance,
   ...consent,
   ...conversations,
   ...customRoles,
@@ -187,6 +190,7 @@ export const ENDPOINTS = {
   ...x,
   ...llmPolicy,
   ...hat,
+  ...mcp,
   ...members,
   ...memory,
   ...mfa,

package/lib/api/endpoints/lucid.js

@@ -86,4 +86,21 @@ export const lucid = {
     path: () => `/api/v1/lucid/herald/test`,
     tags: ['live-safe'],
   },
+  // LUCID-INTELLIGENCE World Model (LI-1): goals, initiatives, decisions, links. People confirm; agents propose.
+  'lucid.world.list': { method: 'GET', service: 'collector', path: () => `/api/v1/lucid/intelligence/world`, tags: ['live-safe'] },
+  'lucid.world.create': { method: 'POST', service: 'collector', path: () => `/api/v1/lucid/intelligence/world`, tags: ['live-write'] },
+  'lucid.world.export': { method: 'GET', service: 'collector', path: () => `/api/v1/lucid/intelligence/world/export`, tags: ['live-safe'] },
+  'lucid.world.erase': { method: 'DELETE', service: 'collector', path: () => `/api/v1/lucid/intelligence/world/mine`, tags: ['live-write'] },
+  'lucid.world.get': { method: 'GET', service: 'collector', path: ({ id }) => `/api/v1/lucid/intelligence/world/${encodeURIComponent(id)}`, tags: ['live-safe'] },
+  'lucid.world.amend': { method: 'PATCH', service: 'collector', path: ({ id }) => `/api/v1/lucid/intelligence/world/${encodeURIComponent(id)}`, tags: ['live-write'] },
+  'lucid.world.confirm': { method: 'POST', service: 'collector', path: ({ id }) => `/api/v1/lucid/intelligence/world/${encodeURIComponent(id)}/confirm`, tags: ['live-write'] },
+  'lucid.world.archive': { method: 'POST', service: 'collector', path: ({ id }) => `/api/v1/lucid/intelligence/world/${encodeURIComponent(id)}/archive`, tags: ['live-write'] },
+  'lucid.world.restore': { method: 'POST', service: 'collector', path: ({ id }) => `/api/v1/lucid/intelligence/world/${encodeURIComponent(id)}/restore`, tags: ['live-write'] },
+  'lucid.world.history': { method: 'GET', service: 'collector', path: ({ id }) => `/api/v1/lucid/intelligence/world/${encodeURIComponent(id)}/history`, tags: ['live-safe'] },
+  // LUCID-INTELLIGENCE LI-2 shadow insights (read-only).
+  'lucid.insights.list': { method: 'GET', service: 'collector', path: () => `/api/v1/lucid/intelligence/insights`, tags: ['live-safe'] },
+  'lucid.insights.status': { method: 'GET', service: 'collector', path: () => `/api/v1/lucid/intelligence/insights/status`, tags: ['live-safe'] },
+  'lucid.insights.get': { method: 'GET', service: 'collector', path: ({ id }) => `/api/v1/lucid/intelligence/insights/${encodeURIComponent(id)}`, tags: ['live-safe'] },
+  // LUCID-INTELLIGENCE LI-3 brief (read-only, never moves a cursor).
+  'lucid.brief': { method: 'GET', service: 'collector', path: () => `/api/v1/lucid/intelligence/brief`, tags: ['live-safe'] },
 };

package/lib/api/endpoints/mcp.js

@@ -0,0 +1,35 @@
+/**
+ * 'mcp.*' endpoints: per-user QuoxMCP tokens and the personalised Claude Desktop bundle.
+ *
+ *   - mcp.tokens.*   auth service, services/auth/routes/mcp-tokens.js (mounted /api/auth/tokens/mcp, requireAuth,
+ *                    scoped to the caller: list/revoke only ever see the caller's own tokens; create needs an org context).
+ *   - mcp.bundle     collector, services/collector/routes/mcp-bundle.js (JWT only). POST { token, collector_url, agent_id }
+ *                    returns a .mcpb zip whose manifest EMBEDS the token as QUOX_SERVICE_KEY. Binary, read with raw: true.
+ */
+
+export const mcp = {
+  'mcp.tokens.create': {
+    method: 'POST',
+    service: 'auth',
+    path: () => '/api/auth/tokens/mcp',
+    tags: ['live-write'],
+  },
+  'mcp.tokens.list': {
+    method: 'GET',
+    service: 'auth',
+    path: () => '/api/auth/tokens/mcp',
+    tags: ['live-safe'],
+  },
+  'mcp.tokens.revoke': {
+    method: 'DELETE',
+    service: 'auth',
+    path: ({ id }) => `/api/auth/tokens/mcp/${encodeURIComponent(id)}`,
+    tags: ['live-write'],
+  },
+  'mcp.bundle': {
+    method: 'POST',
+    service: 'collector',
+    path: () => '/api/v1/mcp/bundle',
+    tags: ['live-write'],
+  },
+};

package/lib/api/endpoints/mon.js

@@ -163,6 +163,12 @@ export const mon = {
     path: ({ id } = {}) => `/api/v1/kuma/monitors/${encodeURIComponent(id)}/resume`,
     tags: ['live-write'],
   },
+  'mon.kuma.monitors.wire-alerts': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/kuma/monitors/${encodeURIComponent(id)}/wire-alerts`,
+    tags: ['live-write'],
+  },
   'mon.kuma.monitors.delete': {
     method: 'DELETE',
     service: 'collector',
@@ -318,12 +324,36 @@ export const mon = {
     path: () => `/api/v1/wazuh/agents`,
     tags: ['live-safe'],
   },
+  'mon.wazuh.read': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ tool }) => `/api/v1/wazuh/read/${tool}`,
+    tags: ['live-safe'],
+  },
   'mon.wazuh.alerts.list': {
     method: 'GET',
     service: 'collector',
     path: () => `/api/v1/wazuh/alerts`,
     tags: ['live-safe'],
   },
+  'mon.wazuh.alerts.triage': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/wazuh/alerts/triage`,
+    tags: ['live-safe'],
+  },
+  'mon.wazuh.coverage': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/wazuh/coverage`,
+    tags: ['live-safe'],
+  },
+  'mon.wazuh.credential.import-instance-env': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/wazuh/credential/import-instance-env`,
+    tags: ['live-write'],
+  },
   'mon.wazuh.deploy-agent': {
     method: 'POST',
     service: 'collector',
@@ -348,6 +378,98 @@ export const mon = {
     path: () => `/api/v1/wazuh/manager/status`,
     tags: ['live-safe'],
   },
+  'mon.wazuh.reports.create': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/wazuh/reports`,
+    tags: ['live-safe'],
+  },
+  'mon.wazuh.reports.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/wazuh/reports`,
+    tags: ['live-safe'],
+  },
+  'mon.wazuh.reports.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/wazuh/reports/${encodeURIComponent(id)}`,
+    tags: ['live-safe'],
+  },
+  'mon.wazuh.reports.verify': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/wazuh/reports/${encodeURIComponent(id)}/verify`,
+    tags: ['live-safe'],
+  },
+  // WAZ P6: Wazuh integratord alert hooks (org admin) and the incidents they open.
+  'mon.wazuh.hooks.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/wazuh/hooks`,
+    tags: ['live-safe'],
+  },
+  'mon.wazuh.hooks.create': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/wazuh/hooks`,
+    tags: ['live-write'],
+  },
+  'mon.wazuh.hooks.rotate': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/wazuh/hooks/${encodeURIComponent(id)}/rotate`,
+    tags: ['live-write'],
+  },
+  'mon.wazuh.hooks.delete': {
+    method: 'DELETE',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/wazuh/hooks/${encodeURIComponent(id)}`,
+    tags: ['live-write'],
+  },
+  'mon.wazuh.incidents.list': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ open, since, limit } = {}) => {
+      const q = [];
+      if (open) q.push('open=1');
+      if (since) q.push(`since=${encodeURIComponent(since)}`);
+      if (limit) q.push(`limit=${encodeURIComponent(limit)}`);
+      return `/api/v1/wazuh/incidents${q.length ? `?${q.join('&')}` : ''}`;
+    },
+    tags: ['live-safe'],
+  },
+  'mon.wazuh.incidents.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/wazuh/incidents/${encodeURIComponent(id)}`,
+    tags: ['live-safe'],
+  },
+  'mon.wazuh.incidents.close': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/wazuh/incidents/${encodeURIComponent(id)}/close`,
+    tags: ['live-write'],
+  },
+  // WAZ P7: read-only host diagnosis (off-list reads are held by the ssh_exec approval gate) and hand-off to QuoxSecurity.
+  'mon.wazuh.incidents.diagnose': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/wazuh/incidents/${encodeURIComponent(id)}/diagnose`,
+    tags: ['live-write'],
+  },
+  'mon.wazuh.incidents.escalate': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ id } = {}) => `/api/v1/wazuh/incidents/${encodeURIComponent(id)}/escalate`,
+    tags: ['live-write'],
+  },
+  'mon.wazuh.vulnerabilities.priority': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/wazuh/vulnerabilities/priority`,
+    tags: ['live-safe'],
+  },
   'mon.wazuh.vulnerabilities.list': {
     method: 'GET',
     service: 'collector',

package/lib/api/endpoints/notesq.js

@@ -19,6 +19,8 @@ export const notesq = {
   'notesq.notes.revisions': { method: 'GET', service: 'collector', path: ({ id }) => `${B}/notes/${id}/revisions`, tags: ['live-safe'] },
   'notesq.notes.revision': { method: 'GET', service: 'collector', path: ({ id, rev }) => `${B}/notes/${id}/revisions/${rev}`, tags: ['live-safe'] },
   'notesq.notes.restore': { method: 'POST', service: 'collector', path: ({ id }) => `${B}/notes/${id}/restore`, tags: ['live-write'] },
+  // ENQRYPT-NOTES: human-only purge of a sealed note's earlier plaintext (revisions, embeddings, derived beliefs).
+  'notesq.notes.sealPurge': { method: 'POST', service: 'collector', path: ({ id }) => `${B}/notes/${id}/seal-purge`, tags: ['live-write'] },
   'notesq.import': { method: 'POST', service: 'collector', path: () => `${B}/import`, tags: ['live-write'] },
   // AQ-9D P4: Action-Q item create (auth, org-scoped), used by `quox notes actions`.
   'notesq.actionq.create': { method: 'POST', service: 'auth', path: ({ orgId }) => `/api/orgs/${orgId}/actions`, tags: ['live-write'] },

package/lib/api/endpoints/quoxplan.js

@@ -40,6 +40,14 @@ export const quoxplan = {
     path: ({ roadmapId }) => `/api/v1/quoxplan/roadmaps/${roadmapId}/streams`,
     tags: ['live-safe'],
   },
+  // One-screen roadmap brief (QUOXPLAN-TERMINAL): top priorities, needs-you,
+  // unblockers, recent movers, stale count. Query: top (1..25), days (1..60).
+  'quoxplan.roadmap.brief.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ roadmapId }) => `/api/v1/quoxplan/roadmaps/${roadmapId}/brief`,
+    tags: ['live-safe'],
+  },
   'quoxplan.roadmap.timeline.get': {
     method: 'GET',
     service: 'collector',
@@ -58,6 +66,21 @@ export const quoxplan = {
     path: ({ roadmapId }) => `/api/v1/quoxplan/roadmaps/${roadmapId}/streams`,
     tags: ['live-write'],
   },
+  // Archive / unarchive a roadmap (QUOXPLAN-TERMINAL, gripe quoxai/quox#1586):
+  // hides it from GET /roadmaps and /search and refuses writes to its streams;
+  // reads by id keep working. Both idempotent server-side.
+  'quoxplan.roadmap.archive': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ roadmapId }) => `/api/v1/quoxplan/roadmaps/${roadmapId}/archive`,
+    tags: ['live-write'],
+  },
+  'quoxplan.roadmap.unarchive': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ roadmapId }) => `/api/v1/quoxplan/roadmaps/${roadmapId}/unarchive`,
+    tags: ['live-write'],
+  },
   'quoxplan.roadmap.export.get': {
     method: 'GET',
     service: 'collector',
@@ -118,4 +141,32 @@ export const quoxplan = {
     path: ({ id }) => `/api/v1/quoxplan/streams/${id}/plan/versions`,
     tags: ['live-safe'],
   },
+  // Action items (QUOXPLAN-TERMINAL: the dashboard's action-item panel had no
+  // CLI counterpart). Server: quoxplan/server/src/api/actionItems.js. Auto
+  // items (kind blocked/decision) are raised by stream status transitions;
+  // manual items are added here. Statuses: OPEN | DONE | CANCELLED.
+  'quoxplan.roadmap.actionItems.list': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ roadmapId }) => `/api/v1/quoxplan/roadmaps/${roadmapId}/action-items`,
+    tags: ['live-safe'],
+  },
+  'quoxplan.stream.actionItems.list': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id }) => `/api/v1/quoxplan/streams/${id}/action-items`,
+    tags: ['live-safe'],
+  },
+  'quoxplan.stream.actionItems.create': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ id }) => `/api/v1/quoxplan/streams/${id}/action-items`,
+    tags: ['live-write'],
+  },
+  'quoxplan.actionItem.update': {
+    method: 'PATCH',
+    service: 'collector',
+    path: ({ actionId }) => `/api/v1/quoxplan/action-items/${actionId}`,
+    tags: ['live-write'],
+  },
 };